Finding the hidden zombie in your network: Statistical approach to unraveling computer botnets

How do you detect a "botnet," a network of computers infected with malware -so-called zombies -- that allow a third party to take control of those machines? The answer may lie in a statistical tool first published in 1966 and brought into the digital age researchers writing this month in the International Journal of Electronic Security and Digital Forensics.

Millions of computers across the globe are infected with malware, despite the best efforts of public awareness campaigns about phishing attacks and antivirus software. Much of the infection is directed towards allowing a third party to take control of a given machine or indeed a network of machines and exploiting them unbeknownst the legitimate users in malicious and criminal activity. Security and software companies do monitor internet activity and there have been many well-publicized successes in destroying such botnets. However, malware writers are always developing new tools and techniques that allow them to infect unprotected computers and rebuild botnets.

Botnets are widely used in organized crime to attempt breaches on security systems by mounting distributed denial of service (dDOS) attacks, among other techniques, on corporate, banking and government systems. Such attacks can open up "backdoors" into a private computer network that lets the botnet controller access proprietary and other sensitive information, passwords or even voting systems. Botnets have also been used for simply malicious purposes to force websites and other services offline, occasionally in an act of protest or rebellion.

Now, R. Anitha and colleagues at PSG College of Technology, Coimbatore, India, have turned to a statistical tool known as the hidden semi-Markov model (HsMM) to help them develop monitoring software that can detect the telltale signs of botnet activity on a computer and so disable the offending malware. In probability theory and statistics, a Markov process is one in which someone can predict the next state of a process based on its current state without knowing the full history of the process. An example in gambling would be that if you have chip now and the odds of winning or losing on the next bet are even then we can predict without knowing how many chips you had earlier that you will either have none or two after the next bet.

A hidden-Markov model would thus include variables of which the observer has no sight but can infer and so predict an outcome. Predicting whether it rained on a given day based on whether a fair-weather-only walker was out on a given day without you having a weather report for their area involves a hidden-Markov process. A hidden semi-Markov model then involves a process of this sort but where the time-elapsed into the current state affects the prediction. For example, one might predict the rainfall pattern based on how long it is since our fair-weather walk last ventured out.

The team has applied the statistical logic of the hidden semi-Markov model to forecast the characteristics of internet activity on a given computer suspected of being a "zombie computer" in a botnet based on management information base (MIB) variables. These variables are the components used to control the flow of data packets in and out of the computer via the internet protocol. Their approach can model the "normal" behavior and then highlight botnet activity as being a deviation from the normal without the specific variables that are altered by the malware being in plain sight.

The team points out that botnet and malware developers have focused recently on web-based, http, type activity, which is easier to disguise among the myriad packets of data moving to and fro across a network and in and out of a particular computer. Their tests on a small zombie computer network shows that the hidden semi-Markov model they have developed as a lightweight and real-time detection system can see through this disguise easily. If implemented widely such as system could lock down this kind of botnet very quickly and slow the assimilation of zombie computers by criminals and others with malicious intent.

View the original article here

Quantum dots provide complete control of photons

By emitting photons from a quantum dot at the top of a micropyramid, researchers at Link?ping University are creating a polarized light source for such things as energy-saving computer screens and wiretap-proof communications.

Polarized light -- where all the light waves oscillate on the same plane -- forms the foundation for technology such as LCD displays in computers and TV sets, and advanced quantum encryption. Normally, this is created by normal unpolarized light passing through a filter that blocks the unwanted light waves. At least half of the light emitted, and thereby an equal amount of energy, is lost in the process.

A better method is to emit light that is polarized right at the source. This can be achieved with quantum dots -- crystals of semiconductive material so small that they produce quantum mechanical phenomena. But until now, they have only achieved polarization that is either entirely too weak or hard to control.

A semiconductive materials research group led by Professor Per Olof Holtz is now presenting an alternative method where asymmetrical quantum dots of a nitride material with indium is formed at the top of microscopic six-sided pyramids. With these, they have succeeded in creating light with a high degree of linear polarization, on average 84%. The results are being published in the Nature periodical Light: Science & Applications.

"We're demonstrating a new way to generate polarized light directly, with a predetermined polarization vector and with a degree of polarization substantially higher than with the methods previously launched," Professor Holtz says.

In experiments, quantum dots were used that emit violet light with a wavelength of 415 nm, but the photons can in principle take on any colour at all within the visible spectrum through varying the amount of the metal indium.

"Our theoretical calculations point to the fact that an increased amount of indium in the quantum dots further improves the degree of polarization," says reader Fredrik Karlsson, one of the authors of the article.

The micropyramid is constructed through crystalline growth, atom layer by atom layer, of the semiconductive material gallium nitride. A couple of nanothin layers where the metal indium is also included are laid on top of this. From the asymmetrical quantum dot thus formed at the top, light particles are emitted with a well-defined wavelength.

The results of the research are opening up possibilities, for example for more energy-effective polarized light-emitting diodes in the light source for LCD screens. As the quantum dots can also emit one photon at a time, this is very promising technology for quantum encryption, a growing technology for wiretap-proof communications.

View the original article here

Storage system for 'big data' dramatically speeds access to information

As computers enter ever more areas of our daily lives, the amount of data they produce has grown enormously. But for this "big data" to be useful it must first be analyzed, meaning it needs to be stored in such a way that it can be accessed quickly when required.

Previously, any data that needed to be accessed in a hurry would be stored in a computer's main memory, or dynamic random access memory (DRAM) -- but the size of the datasets now being produced makes this impossible.

So instead, information tends to be stored on multiple hard disks on a number of machines across an Ethernet network. However, this storage architecture considerably increases the time it takes to access the information, according to Sang-Woo Jun, a graduate student in the Computer Science and Artificial Intelligence Laboratory (CSAIL) at MIT.

"Storing data over a network is slow because there is a significant additional time delay in managing data access across multiple machines in both software and hardware," Jun says. "And if the data does not fit in DRAM, you have to go to secondary storage -- hard disks, possibly connected over a network -- which is very slow indeed."

Now Jun, fellow CSAIL graduate student Ming Liu, and Arvind, the Charles W. and Jennifer C. Johnson Professor of Electrical Engineering and Computer Science, have developed a storage system for big-data analytics that can dramatically speed up the time it takes to access information.

The system, which will be presented in February at the International Symposium on Field-Programmable Gate Arrays in Monterey, Calif., is based on a network of flash storage devices.

Flash storage systems perform better at tasks that involve finding random pieces of information from within a large dataset than other technologies. They can typically be randomly accessed in microseconds. This compares to the data "seek time" of hard disks, which is typically four to 12 milliseconds when accessing data from unpredictable locations on demand.

Flash systems also are nonvolatile, meaning they do not lose any of the information they hold if the computer is switched off.

In the storage system, known as BlueDBM -- or Blue Database Machine -- each flash device is connected to a field-programmable gate array (FPGA) chip to create an individual node. The FPGAs are used not only to control the flash device, but are also capable of performing processing operations on the data itself, Jun says.

"This means we can do some processing close to where the data is [being stored], so we don't always have to move all of the data to the machine to work on it," he says.

What's more, FPGA chips can be linked together using a high-performance serial network, which has a very low latency, or time delay, meaning information from any of the nodes can be accessed within a few nanoseconds. "So if we connect all of our machines using this network, it means any node can access data from any other node with very little performance degradation, [and] it will feel as if the remote data were sitting here locally," Jun says.

Using multiple nodes allows the team to get the same bandwidth and performance from their storage network as far more expensive machines, he adds.

The team has already built a four-node prototype network. However, this was built using 5-year-old parts, and as a result is quite slow.

So they are now building a much faster 16-node prototype network, in which each node will operate at 3 gigabytes per second. The network will have a capacity of 16 to 32 terabytes.

Using the new hardware, Liu is also building a database system designed for use in big-data analytics. The system will use the FPGA chips to perform computation on the data as it is accessed by the host computer, to speed up the process of analyzing the information, Liu says.

"If we're fast enough, if we add the right number of nodes to give us enough bandwidth, we can analyze high-volume scientific data at around 30 frames per second, allowing us to answer user queries at very low latencies, making the system seem real-time," he says. "That would give us an interactive database."

As an example of the type of information the system could be used on, the team has been working with data from a simulation of the universe generated by researchers at the University of Washington. The simulation contains data on all the particles in the universe, across different points in time.

"Scientists need to query this rather enormous dataset to track which particles are interacting with which other particles, but running those kind of queries is time-consuming," Jun says. "We hope to provide a real-time interface that scientists can use to look at the information more easily."

View the original article here

Privacy compliance for big data systems automated: Search engine code is moving target that eludes manual audits

Web services companies, such as Facebook, Google and Microsoft, all make promises about how they will use personal information they gather. But ensuring that millions of lines of code in their systems operate in ways consistent with privacy promises is labor-intensive and difficult. A team from Carnegie Mellon University and Microsoft Research, however, has shown these compliance checks can be automated.

The researchers developed a prototype automated system that is now running on the data analytics pipeline of Bing, Microsoft's search engine. According to Saikat Guha, researcher at Microsoft, it's the first time automated privacy compliance analysis has been applied to the production code of an Internet-scale system and is a reflection of Microsoft's commitment to creating the technology necessary to further safeguard the privacy of customers.

Employing a new, lawyer-friendly language to specify privacy policies and using a data inventory to annotate existing programs, the researchers showed that a team of just five people could manage a daily compliance check on millions of lines of code written by several thousand developers.

They presented their research findings at the 35th IEEE Symposium on Security & Privacy, May 18-21, in San Jose, Calif.

"Companies in the United States have a legal obligation to declare how they use personal information they gather and it's also good business to establish a bond of trust with customers," said Anupam Datta, associate professor of computer science and electrical and computer engineering. "But these systems are constantly evolving and their scale can be daunting. The manual methods typically used for checking compliance are labor intensive, yet too often fail to catch all violations of policy."

"Tens of millions of lines of code are already in the pipeline," noted Shayak Sen, a Ph.D. student in computer science who interned at Microsoft Research India and the lead student author on the study. "And during our implementation on Bing, we found that more than 20 percent of the code was changing on a daily basis." At these large scales, automated methods offer the best hope of verifying compliance.

"One reason that gaps exist between policies set by a company's privacy team and the code written by software developers is that the two groups don't speak the same language," Datta said. Lawyers and privacy champions typically have little experience in programming and developers attempting to translate policies into code can get tripped up by ambiguities in the language of the privacy policies.

So the researchers developed a language -- Legalease -- that could be easily learned and used by privacy advocates. It employs allow-deny rules with exceptions, a structure that is found in many privacy policies and laws, such as the Health Insurance Portability and Accountability Act (HIPAA), and is expressive enough to capture the real policies of an industrial-scale system such as Bing.

In preliminary usability testing, a dozen Microsoft employees were given a one-page document explaining Legalease and spent an average of under 5 minutes studying it. They then took an average of less than 15 minutes to encode nine Bing policy clauses regarding how user information can be used. "They were able to perform this task with a high degree of accuracy, which is encouraging," Sen said.

But encoding privacy policies correctly means little if it cannot be applied to large codebases written by large teams of programmers. To solve this dilemma, the researchers leveraged Grok -- a data inventory that annotates existing programs written in languages typically employed by MapReduce-like systems, such as those used by Bing and Google -- for their backend data analytics over user data.

Grok performs this automated annotation by combining information from different sources with varying levels of confidence. For instance, automated pattern-matching to column names can be performed across an entire database, but with low confidence, while annotations by developers have high confidence, but low coverage.

Grok had been developed by Microsoft Research and deployed by Bing for the express purpose of automating privacy compliance checking the previous year, but writing policies for Grok was cumbersome.

"Legalease was the final piece of the automated privacy compliance jigsaw puzzle," Guha said. "Developed over Sen's internship and subsequent collaboration with CMU, Legalease bridged privacy teams with Grok, and through Grok, with the developers."

Datta said automating the process of compliance checks could push the industry to adopt stronger privacy protection policies.

"Sometimes, companies want to make their policies stronger, but hesitate because they are not sure they can ensure compliance in these large systems," he explained, noting that online privacy policy compliance is enforced in the United States by the Federal Trade Commission.

The research team included Sriram K. Rajamani of Microsoft Research in Bangalore, India; Janice Tsai of Microsoft Research, Redmond, and Jeannette Wing, corporate vice president of Microsoft Research and former head of CMU's Computer Science Department.

This research was supported, in part, by the Air Force Office of Scientific Research and the National Science Foundation.

View the original article here

Security and privacy? Now they can go hand in hand

Online identification and authentication keeps transactions secure on the Internet, however this has also implications for your privacy. Disclosing more personal information than needed online when, say, you log in to your bank website may simplify the bank's security at the cost of your privacy. Now, thanks to research by the EU-funded project Attribute-based Credentials for TrustABC4Trust , there is a new approach that keeps systems secure and protects your identity.

The ABC4Trust research team is piloting this technology with young people, often thought to be the less careful about their online security. But 'that's not the case', says Prof. Dr. Kai Rannenberg , Coordinator of the ABC4Trust project, 'The participants were very interested in learning which personal data they reveal and how they can control this. The university students especially feel that Attribute-based Credentials (ABCs) can help them manage their e-identities and enable them use Internet services in a privacy preserving way.'

For example, at Norrtullskolan secondary school in S?derhamn, Sweden, pupils can access counselling services online. However, until recently the pupils couldn't access these services using a pseudonym -- they had to identify themselves by name so the school could check whether they were allowed to use them.

But in the ABC4Trust pilot scheme, each child is issued with a 'deck' of digital certificates that validate information like their enrollment status, their date of birth and so on. This allows the school pupils to enjoy both privacy and security. Instead of having to reveal their whole identity when using the counselling service they can simply use one of the certificates in their deck that pseudonymously verifies they are enrolled at the school.

Another pilot developed at the Computer Technology Institute and Press "Diophantus" and trialled at the University of Patras , Greece, allows students to give anonymous feedback on their courses and lecturers, while ensuring that only registered students can take part in the polls.

Prof. Rannenberg says, 'Our user studies showed, that the school children, parents and the university students are happy that they are giving less of their private information when they access the services and leave feedback. Also the respective authorities are happy with the pilots and the feedback; in the not too distant future we expect more European public services and other organisations switch to Privacy-ABCs.'

Users want Privacy, Organisations want Security

According to recent research by market research organisation, Ovum, 68 % of us in the EU would like to opt out of having our personal data tracked. In a speech in May , Commissioner Neelie Kroes stressed that it is essential for EU business 'To show the citizen that going online is not just convenient, but trustworthy… With resilient and secure networks and systems I think we can build that trust.'

ABC4Trust is a 13.05 Million Euro project, with 8.85 Million Euro funded by the European Union's Seventh Framework Programme (FP7) . The international and multidisciplinary ABC4Trust consortium is led by Johann Wolfgang Goethe-Universit?tFrankfurt am Main, Germany and it is composed of 11 partners from 7 countries. ABC4Trust started in November 2010 and will run for 4 ? years.

View the original article here

Privacy and vulnerability issues: Could decentralized networks help save democracy?

Democratic movements can flourish online, but just as easily get censored. A group of researchers is developing solutions to the vulnerabilities and privacy problems with using big social media platforms like Facebook and Twitter.

Turkish President Recep Tayyip Erdogan disrupted communications between his opponents when he shut down Twitter during the run-up to the country's recent election. But in doing so, he provided yet more proof of how flawed social web activism can be. Whether the lessons in Turkey are heeded could have serious consequences for democracy.

Social networks such as Twitter and Facebook have enabled unprecedented levels of communication and have even received credit for at least one major democratic revolution. There's just one problem: because of their monolithic nature, these centralized networks expose users to snooping and interference of the kind Erdogan caused, says Sonja Buchegger, Associate Professor of Computer Science at KTH Royal Institute of Technology.

A single, large-scale platform provides an easier target for anyone who wants to interfere with online political activity, says Buchegger. "But, if Twitter were decentralized, and you had users cooperating and communicating directly, that wouldn't have been possible to disrupt.

"Decentralization allows for greater freedom of expression.

The good news is that there could be a computer science answer to the problem. Buchegger is leading a group of scientists at KTH who are creating building blocks that developers could use to launch decentralized, distributed networks, which would not only be difficult to interfere with, but would also protect people from government snooping.

"The internet itself is not centralized -- it would be hard to shut down," Buchegger says. "It was built as a robust, decentralized tool to communicate; and we can do the same for other services that are now centralized, like social networks."

Whether the demand for such networks would go mainstream any time soon is hard to tell. Buchegger notes that it is difficult for most people to wrap their head around the notion that their personal information is exposed on web-based email and social platforms.

"The whole privacy issue online is very young, and the population is not used to thinking in this way," she says. "Offline, we know how to protect our privacy; we know who can overhear us; we see who is in the room with us and we know whether we can trust those people; but online we haven't really grasped who the audience is and how that changes over time."

Buchegger's research is focused on the privacy issues of distributed peer-to-peer (P2P) networks, that is, the underlying infrastructure for a decentralized system in which people could store their data beyond the reach of data miners or government surveillance.

"We are developing these little building blocks: this is how you do passwords in a distributed environment; this is how you do search in a privacy-preserving decentralized environment; this is how you make news feeds; this is how you control access," she says. "Then you can put the building blocks together and build a new communications system -- that's the idea."

For example, encryption tools are being tested that could provide users with "fine grain" control over their privacy. One could use encryption keys to decide specifically who can access or view a given piece of content. "You wouldn't have to worry about all the people you don't want to access it because the default is that access is denied," she says.

The research into privacy tools cuts right to one of the major weaknesses of centralized networks -they rely on centralized data centers for storage, thus exposing millions of people's personal information to prying eyes.

Buchegger says that as far as promoting democracy goes, distributed networks could outshine so-called "Facebook revolutions," encouraging more widespread activism, particularly for those whose only connection to the web is with a phone.

"This is a way of developing the idea of a commons, in which more people get together and organize and share resources," she says. "A decentralized network would also be a sort of commons because you could imagine how people with large servers could store encrypted data for others. It could enable access to resources for those who cannot store so much on their phone."

While distributed networks offer potential for greater communication and more effective organizing, Buchegger is quick to point out that technology is not a quick fix for promoting democracy. Ultimately political action depends on people assembling in the non-virtual world. "There is a danger that you think that just because you repost something on Facebook or Twitter that you are doing activism, but it's not actually doing something.

"Networks can reach more people and be used to organize physical activism, but they're not a substitute for activism."

Cite This Page:

KTH The Royal Institute of Technology. "Privacy and vulnerability issues: Could decentralized networks help save democracy?." ScienceDaily. ScienceDaily, 12 May 2014. .KTH The Royal Institute of Technology. (2014, May 12). Privacy and vulnerability issues: Could decentralized networks help save democracy?. ScienceDaily. Retrieved May 30, 2014 from www.sciencedaily.com/releases/2014/05/140512101634.htmKTH The Royal Institute of Technology. "Privacy and vulnerability issues: Could decentralized networks help save democracy?." ScienceDaily. www.sciencedaily.com/releases/2014/05/140512101634.htm (accessed May 30, 2014).

View the original article here

Computer security: Reducing risks of malware infections

Installing computer security software, updating applications regularly and making sure not to open emails from unknown senders are just a few examples of ways to reduce the risk of infection by malicious software, or "malware." However, even the most security-conscious users are open to attack through unknown vulnerabilities, and even the best security mechanisms can be circumvented as a result of poor user choices.

"The reality is that successful malware attacks depend on both technological and human factors," says Professor Jos? Fernandez. "Although there has been significant research on the technical aspects, there has been much less on human behaviour and how it affects malware and defence measures. As a result, no one at the present time can really say how important these factors are. For example, are users who are older and less computer-savvy more open to infection?" It is therefore necessary to take a closer look at the impact that both technological and human factors have on the success or failure of protective mechanisms.

To answer this type of question, Prof. Fernandez and his team drew inspiration from the clinical trial method to design the first-ever study applied to computer security. In a fashion similar to medical studies that evaluate the effectiveness of a particular treatment, their experiment was aimed at assessing the performance of anti-virus software and the likelihood that participants' computers would become infected with malware. The four-month study involved 50 subjects who agreed to use laptops that were instrumented to monitor possible infections and gather data on user behaviour. "Analyzing the data allowed us not only to identify which users were most at risk, based on their characteristics and behaviour, but also to measure the effectiveness of various protective measures," says Polytechnique student Fanny Lalonde L?vesque, who is writing her master's thesis on this project.

This pilot study provided some very interesting results on the effectiveness of computer defences and the risk factors for infection. For example, 38% of the users' computers were exposed to malware and 20% were infected, despite the fact that they were all protected by the same anti-virus product, which was updated regularly. With regard to the users themselves, there did not seem to be any significant difference in exposure rates between men and women. In addition, the most technically sophisticated users turned out to be the group most at risk… This result may seem counter-intuitive, as it contradicts the opinion of some computer experts who argue that people should have a kind of "Internet license" before going online. "The results of this study provide some intriguing insights. Are these 'expert' users at higher risk because of a false sense of security, or because they are naturally curious and therefore more risk-tolerant? Further research is needed to understand the causes of this phenomenon, so that we can better educate and raise awareness among users," says Professor Fernandez. In the future, this type of study will help provide scientific data to support decision-making on security management, education, regulation and even computer security insurance. A second phase, which will involve hundreds of users over a period of several months, is already being prepared.

The initial results of this experiment were presented at the ACM Conference on Computer and Communications Security (CCS), which took place November in 2013 in Berlin, Germany.

View the original article here